Throwing more hardware at a bottleneck in the disk subsystem isn't always effective. By load-balancing your existing disk subsystem, you can capitalize on your investment and better understand when and where to add disk hardware, if needed. The key to load-balancing your NT Server disk subsystem is to identify which disk device is the bottleneck, understand the characteristics of the application using the disk device, and determine which files on the disk device the application is using. Performance Monitor is an excellent tool to help you identify which disk device is the bottleneck. (For information about using Performance Monitor to improve disk I/O, see "The Beginner's Guide to Optimizing Windows NT Server, Part 2," August 1997 on my Web site) Unfortunately, Performance Monitor alone isn't enough. To understand how and where to distribute your disk workload, you must know which applications (processes) access which files on the disk device.
After you identify which disk device is the bottleneck, you can use two techniques to help you isolate the files on the disk device that your applications use. The first technique involves using NT's internal auditing feature (available under Administrative Tools/UserManager/Policies/Audit) to alert you when applications access specific files. This technique is helpful, but the auditing feature generates and sends output to the Event Monitor and can be challenging to decrypt. Auditing also adds a lot of overhead to both the CPU and the disk subsystem selected for auditing.
The second technique, which I find easier to implement, is using Systems Internals' freeware tool, Filemon.exe, which is available at http://www.sysinternals.com/. After you download this utility, you just unzip the file and run the utility during high-usage periods to get a feel for the specific files that your applications are accessing on the disk subsystem, as Figure 1 shows.
Tracking Which Application/Process is accessing which location of the disk subsystem
Filemon gives you the data that you need to load-balance your disk subsystem. As Figure 1 shows, you can determine which process is accessing which part of the disk subsystem. By using Filemon with Performance Monitor, you can decide which disk devices to move files from (disks with a high % Disk Time, a combination of read time and write time), which files to move, and where to move them (disk devices whose % Disk Time is low).
Not only does Filemon tell you which applications access which files on which disk devices, but it also can show you whether the disk requests are a read or write activity. As a result, you have more granular data to use when deciding which RAID level to use or when adding standalone disks.
Be careful when you move files around to different volumes under NT. Make sure that the shares and permissions are properly set after you move the files. If the files are associated with a specific application, you might need to move the files using the application or update the registry. You can determine how you move the files in the disk subsystem according to the applications running in your environment. Regardless of your environment, you will want to have a complete system backup available to restore from, if necessary. I also suggest that you make sure no active users are on your system when you make changes to your disk subsystem; otherwise, frustrated end users might complain. Always remember to test your application before and after you move any files to ensure that you don't accidentally break anything.